CN112272178B - Attack data packet tracing method and system based on dynamic probability double-domain packet marking - Google Patents

Attack data packet tracing method and system based on dynamic probability double-domain packet marking Download PDF

Info

Publication number
CN112272178B
CN112272178B CN202011148590.4A CN202011148590A CN112272178B CN 112272178 B CN112272178 B CN 112272178B CN 202011148590 A CN202011148590 A CN 202011148590A CN 112272178 B CN112272178 B CN 112272178B
Authority
CN
China
Prior art keywords
marking
probability
attack
router
domain
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202011148590.4A
Other languages
Chinese (zh)
Other versions
CN112272178A (en
Inventor
李腾
肖泽宇
张翔宇
温子祺
廖艾
彭宇飞
张胜凯
魏大卫
马卓
沈玉龙
马建峰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Xidian University
Original Assignee
Xidian University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Xidian University filed Critical Xidian University
Priority to CN202011148590.4A priority Critical patent/CN112272178B/en
Publication of CN112272178A publication Critical patent/CN112272178A/en
Application granted granted Critical
Publication of CN112272178B publication Critical patent/CN112272178B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis

Abstract

A tracing method and a tracing system for attacking data packets based on dynamic probability double-domain packet markers are provided, wherein the tracing method comprises the following steps: setting a label space of the two-domain label domain; marking the two marking domains by adopting opposite marking strategies; after the attack is detected, the victim host counts all attack data packets and reconstructs an attack path by two steps: (1) all the occurring mark information in the mark domain is the router forming the attack path; (2) counting the occurrence times of the marking information; m is1、m2Respectively representing two marker domains in the marker space; m is1The more frequently appearing routers are closer to the victim host, and the times are decreased progressively along the attack path to the attack host; m is2The router with the larger occurrence number is closer to the attacking host, and the number of times of the router with the larger occurrence number is decreased towards the victim host along the attacking path. The invention also provides a system for realizing the method, and the system meets the requirement of high security in the autonomous local area network.

Description

Attack data packet tracing method and system based on dynamic probability double-domain packet marking
Technical Field
The invention belongs to the field of network attack tracing, and particularly relates to an attack data packet tracing method and system based on dynamic probability double-domain packet marking.
Background
In recent years, with the rapid development of the internet, people store a lot of high-value data in the network. However, the increasingly frequent network attacks do not ensure effective security of these high-value data or network facilities, which puts various demands on the construction of new networks, including high requirements on security. Organizations such as banks, securities, education, medical treatment, government and the like frequently suffer from network attacks, causing huge economic losses. Although these organizations often have mature internal network architectures, the relatively closed internal network still has difficulty in resisting high-technology network attacks due to the development of network attack technology.
The establishment of a relatively closed local area network can resist direct attacks from an external network, but can still indirectly launch attacks to the inside of the local area network through some infected hosts, namely a springboard. Accessing a local area network via a removable storage device such as a usb disk may also implant viruses into the system, even if isolated from the external network, there is a risk. At present, local area network attacks still have a small proportion in network attacks, and great harm is brought to system safety. Simply isolating the local area network from the external network cannot completely stop the network attack, and the improvement of the network attack defense capability requires the establishment of a complete and reliable network security system.
In order to establish a safe and reliable network system, not only the passive defense of the network attack needs to be strengthened, but also active countermeasures need to be taken for the network attack. The tracing of the attack data packet is also important in effectively detecting and early warning the network attack. The attack tracing means that during the network attack process or after the network attack is finished, the network attack source is inferred through related technologies, the related information of the currently obtained network attack data packet is analyzed, the attack data packet is traced, the host initiating the attack in the system is further traced and found, the host initiating the attack is reported to an upper-layer administrator, the host initiating the attack is timely taken a limiting measure, and more losses caused by the attack are avoided. According to the basic principle of the network attack tracing technology, the existing tracing method can be divided into two types: a mark type and a log type. The 'marking type' scheme writes the router information on the attack path into the data packet, and assists the victim host in recovering the attack path and tracing. In a logging-type scheme, a router logs some information of traversal packets to verify whether a suspicious packet is forwarded by the router. The marking scheme needs to carry out a certain amount of statistics on the attack data packets, and an attack path is difficult to reconstruct accurately when the attack data packets are few. The "logging type" scheme has an additional requirement on the storage of the router, and when the data volume is large, the log information recorded by the router is too large and redundant to be stored.
Disclosure of Invention
The invention aims to provide an attack data packet tracing method and system based on dynamic probability double-domain packet marking, aiming at the defects of attack data packet tracing in the prior art, so that the requirement of high security in an autonomous local area network is met, an attack path can be accurately reconstructed under the condition of less attack data packets, and a router is not required to store logs for the data packets.
In order to achieve the above object, the present invention has the following technical means:
a tracing method of attack data packets based on dynamic probability double-domain packet marking comprises the following steps:
setting a label space of the two-domain label domain;
marking the two marking domains by adopting opposite marking strategies;
after the attack is detected, the victim host counts all attack data packets and reconstructs an attack path by two steps:
(1) all the occurring mark information in the mark domain is the router forming the attack path;
(2) counting the occurrence times of the marking information; m is1、m2Respectively representing two marker domains in the marker space; m is1The more frequently appearing routers are closer to the victim host, and the times are decreased progressively along the attack path to the attack host; m is2The router with the larger occurrence number is closer to the attacking host, and the number of times of the router with the larger occurrence number is decreased towards the victim host along the attacking path.
Preferably, in the marking process, the router selects the most appropriate marking probability according to different data packets, the hop count forwarded by the router is judged according to the TTL field of the data packets, so that a marking probability correction coefficient is calculated, the marking probability is indirectly controlled through the probability correction coefficient, finally, the distribution function of the marking probability is close to linearization, and the accuracy of tracing the attacking data packets is optimized; the modification of the marking probability is only related to the property of the data packet, but not related to the router, and the marking probability is selected in an adaptive mode.
Preferably, a flag space is set in a 33-bit field relating to the IP data packet and the fragment, and 16 bits are set as m1Flag field, another 16 bits set to m2The flag field further has 1 bit as a flag bit F indicating whether or not the adaptive flag probability is used, and if the F bit is 1, the flag bit indicates that the adaptive flag probability is used, and if the F bit is 0, the flag bit indicates that the adaptive flag probability is not used.
Preferably, when the packet is forwarded by the router, the router forwards the packet with a probability p1Marking own routing information to m of data packet1In the mark field, with a probability p2Marking own routing information to m of data packet2In the mark field, m1The "overlay" criterion is enforced in the mark field, and m2The "back-off" criterion is enforced in the mark field: router preparation to m1When writing in the mark field, if m1The label domain has been labeled by other routers, which are still in probability p1At m1Writing mark information in the mark field for covering; whileReady to m2When writing in the mark field, if m2The mark domain is marked by other router, then the router does not continue to go to m2Writing in the mark field.
Preferably, the specific initial value of the TTL field is determined by an operating system, TTL values of different operating systems are different, and the label probability correction factor is determined by subtracting TTL values after the router forwards a plurality of hops from the initial TTL value of the operating system.
Preferably, if the data packet does not reach the target host for more than 20 hops in the network transmission, the data packet is regarded as the target unreachable and is discarded.
The invention also provides an attack data packet tracing system based on the dynamic probability double-domain packet marking, which comprises the following steps:
the double-domain mark space setting module is used for setting a mark space by utilizing fields related to fragments in the IP data packet in the data packet, the mark space is divided into two mark domains, and the mark space in each mark domain is used for the router to write self information;
the marking module is used for executing a 'coverage' criterion on the first marking domain and executing a 'deferral' criterion on the second marking domain by setting a marking strategy, and the two marking domains are marked by adopting opposite marking strategies;
the data packet statistical analysis module is used for counting all attack data packets of the damaged host to reconstruct an attack path, and all the occurring marking information in the marking domain is the router forming the attack path; counting the occurrence times of the marking information; m is1The router with more occurrence times in the mark domain is closer to the victim host, and the times along the attack path to the attack host are decreased progressively; m is2The router with the more times of appearance in the mark field is closer to the attacking host, and the times of appearance in the mark field are decreased towards the victim host along the attacking path.
Preferably, the marking module realizes that the router selects the most appropriate marking probability according to different data packets, the hop count forwarded by the router of the data is judged according to the TTL field of the data packets, so as to calculate the marking probability correction coefficient, the marking probability is indirectly controlled through the probability correction coefficient, finally, the distribution function of the marking probability is close to linearization, and the accuracy of tracing the attacking data packets is optimized.
Compared with the prior art, the invention has the following beneficial effects: the marking space adopts two marking domains, different strategies are adopted for marking, opposite characteristics are presented on the image of the distribution function, the defect that the source tracing is not accurate at the tail of a certain section of the reconstructed attack path when one marking domain is adopted is overcome, and therefore the accuracy of the whole source tracing result is improved. After the attack is detected, all attack data packets are counted by the victim host to reconstruct an attack path, and a router is not required to store logs for the data packets.
Furthermore, the router is marked by using a dynamic probability marking method in the marking process, so that the router can calculate a revision coefficient according to the propagation distance of the data packet, and finally, the marking probability is adaptively adjusted.
Furthermore, the invention enables the label quantity gradient of different routers to be obvious when the data packet statistics is finally carried out by self-adaptively adjusting the label probability, thereby being beneficial to reducing errors brought by distinguishing the router sequence under the condition of smaller data packet quantity, and therefore, the attack path can be effectively reconstructed under the condition of less data packets.
Further, the routers of the present invention compute pressure equalization, and the number of forwarded packets at the edge routers in the network is smaller than that at the core routers. According to the distribution function of the marking probability, the marking probability of the data packet when passing through the edge router is larger than that of the core router. Therefore, the marking times of the edge router and the network core router are approximately balanced, the marks are prevented from being concentrated in a certain part of branch routers, and the effect of calculating pressure balance by the routers in the system is achieved.
Drawings
FIG. 1 is a flow chart of an attack data packet tracing method of the present invention;
FIG. 2 is a comparison graph of the front and back effects of the present invention using an adaptive probability algorithm;
FIG. 3 is a flow diagram of a dual-domain packet tag analysis of the present invention;
FIG. 4 is a comparison diagram of the tracing accuracy rate of the present invention using a two-domain labeling method.
Detailed Description
The present invention will be described in further detail with reference to the accompanying drawings.
The attack data packet tracing method based on the dynamic probability double-domain packet marking combines the advantages of the dynamic probability packet marking algorithm on the basis of the probabilistic packet marking algorithm, two marking domains are arranged at the packet head of an IP message, and a router calculates the marking probability revision parameter and records the information of the router to the two marking domains respectively through two marking strategies. The general flow diagram is shown in fig. 1. When the network attack is detected, the affected host can count the attack data packet and effectively trace the attack path of the data packet.
1. Setting a mark space;
for the setting of the mark space, a free data packet in the header of the IP message is used as the record space of the mark. The current network is continuously perfected, the situation of data packet fragmentation is greatly reduced and is less than 0.25% of the total quantity, and the proportion is further reduced along with the continuous perfection of network link equipment in the future. Fragmentation can be further avoided by using an automatic maximum transmission unit discovery mechanism. Therefore, a total of 33 bits of control fields associated with the fragment in the header of the IP data packet are used for setting the label space. Wherein 16 bits are set as m1Flag field, 16 bits set to m2And a mark field, and the other 1 bit is used as a flag bit F for whether the adaptive mark probability is used. If the F bit is 1, the adaptive flag probability is used, and if the F bit is 0, the adaptive flag probability is not used.
2. A labeling algorithm;
the mark space contains two mark fields m1And m2. When a packet is forwarded by a router, the router forwards the packet with a probability p1Marking own routing information to m of data packet1In the mark field, simultaneously with p2Marking the routing information of the label probability to m of the data packet2In the mark field. Except that in m1The "overlay" criterion is enforced in the mark field, whereas in m2The mark field implements a "back-off" criterion.That is, the router prepares to m1When writing in the mark field, if m1Has been marked by other routers, the router still has probability p1At m1And the mark information is written in the data storage unit for overwriting. When the router prepares m2When writing in the mark field, if m2Marked by other router, the router does not continue to go to m2And (4) writing.
Through the setting of the two marking domains and the two marking algorithms, the accuracy of tracing and the shorter tracing time can be improved in the data packet statistics process after the network attack is detected.
3. Adaptively adjusting the marking probability;
in the above labeling strategy, it is assumed that the labeling probability of each router in the topological network for two labeled domains is constant. If the label probability is selected as
Figure GDA0003272335250000061
At best, the data packets required to reconstruct the attack path are minimal. However, in the current routing protocol, each packet forwarding is performed by looking up the routing table to determine the router closest to the destination. It is therefore not known how many routers the packet will be forwarded through before it reaches the final destination, i.e. d is indeterminate.
The invention analyzes the distance between the selection of the mark probability and the attack path, p1、p2And the value is adaptively taken according to the system condition, so that the accuracy of the tracing path can be improved, and the number of data packets required by reconstructing the attack path is reduced.
Fig. 2 shows a comparison of probability distribution functions for the case of 10 routers. The algorithm of the ordinary probability packet marking is shown as a lower curve in the figure, the abscissa is each router on an attack path, and the ordinate is the marking probability. When the number of packets reaches a certain number, the tag probability also indicates the number of tags. In the subsequent tracing process, the data packets are counted, and the distance relation is determined by the number of marks of different routers. In FIG. 2, without adaptive probability algorithm, the gradient after Router No. 6 is comparedAnd small, large errors are easy to generate during tracing. Therefore, the gradient of the labeling probability of different routers needs to be expanded as much as possible to improve the accuracy of tracing. In order to expand the labeling probability number gradient of different routers, it is necessary that the curve is as close to linear as possible, i.e. the second derivative of the concave function is smaller, to achieve the goal of the curve. Thus, in m1Label domain, for example, label probability p for each router1The marking is performed by multiplying by a distance coefficient which decreases with distance during the propagation of the data packet. And the existing TTL field of the IP data packet header has a distance counting function, so that the distance coefficient can be determined by combining the TTL field. The specific initial value of the TTL field is determined by the operating system, and the TTL values may be different for different operating systems, as shown in table 1.
TABLE 1
Operating system TTL initial value
Windows 98 32
Linux 64/255
Windows NT/2000/XP 128
UNIX 255
Generally, a data packet is difficult to exceed 20 hops in network transmission, and if the data packet does not reach the target host beyond 20 hops, the data packet is regarded as a target unreachable and is discarded. In a local area network, packets may be forwarded fewer times through a router. Therefore, the initial TTL value of the operating system can be presumed to subtract the current TTL value to determine the marker probability correction factor.
The distance coefficient is determined through TTL so as to balance the marking probability, so that the distribution function is more linear, and the tracing accuracy under the condition of small data packet quantity is improved.
As shown in fig. 2, after the adaptive probability algorithm is applied, the higher bars represent the label probabilities of different routers after the adaptive probability algorithm is applied. Compared with the column which does not adopt the adaptive probability, the gradient of the column which adopts the adaptive probability is larger, so that the error can be greatly reduced in the data packet counting process.
4. Carrying out statistical analysis on the data packets and reconstructing an attack path;
after the attack is detected, the victim host counts all attack data packets. The attack path is reconstructed in two steps:
(1) all the occurring label information in the label domain is the router forming the attack path.
(2) The number of occurrences of the marker information is counted. m is1、m2Respectively representing two marker domains in the marker space. m is1The router with the larger occurrence number is closer to the victim host, and the number of times of the router with the larger occurrence number is decreased towards the aggressor host along the aggressor. m is2The router with the larger occurrence number is closer to the attacking host, and the number of times of the router with the larger occurrence number is decreased towards the victim host along the attacking path.
After the victim host is attacked, the routing information marked by the marking field in the received data packet is counted, and the times of the same routing information are counted and sequenced. Assume that attack path G ═ a, R1,R2,...,RdB), where A, B represents the aggressor and victim hosts, respectively, Ri( i 1, 2.., d) represents a router through which an attack packet sent by an attacking host to a victim host passes.
Figure GDA0003272335250000071
Representation router RiFor m in data packetCLabeling probability of a labeled domain.
During the forwarding process of the attack data packet in the attack path G, each router RiWith equal probability p1To m1The label field is labeled and implements the "overlay" criterion, and information labeled by a previous router may be replaced by a later router. Thus:
Figure GDA0003272335250000072
Figure GDA0003272335250000073
Figure GDA0003272335250000081
Figure GDA0003272335250000082
then the probability of marking the data packet by the router is recurred according to the rule, and the detailed description is omitted
Figure GDA0003272335250000083
And then calculated.
It can be deduced that:
Figure GDA0003272335250000084
Figure GDA0003272335250000085
Figure GDA0003272335250000086
it can be seen that for m1The field of the tag is marked,
Figure GDA0003272335250000087
will decrement as i decreases. This represents the number m1The more the marker information count of a certain router in the router table indicates that the router is closer to the victim host in the attack path; if the distance from the victim host is farther, the victim host receives fewer data packets marked by the router, so that the data packets m can pass1And marking the times of occurrence of each routing information in the domain to distinguish the distance of the router, thereby reconstructing the attack path.
However, by analysis
Figure GDA0003272335250000088
The probability distribution characteristic of (a) shows that when the value of i is small, namely the i is closer to the attacking host and farther from the victim host in the attacking path,
Figure GDA0003272335250000089
the situation will be smaller, even appear as zero or negative, which represents that it is difficult to accurately distinguish the distance in the attack path by marking the number of times of occurrence of the information at this time, and the adoption of the statistical method can cause source tracing errors. As shown in fig. 2, the labeling probability gap of the histogram after router number 6 is small. Needs to adopt a method which leads the attack host to be close to the victim host and the attack host to be far away from the victim host, namely, i takes a small value
Figure GDA00032723352500000810
Larger m2A labeling algorithm. The invention passes through2The marking algorithm makes up for m1The marking algorithm is insensitive to marks when the attacking host is closer.
m2The mark field adopts the 'back-off' rule, and when the attack data packet is along the attack path G ═ A, R1,R2,...,RdAnd B) in the forwarding process, if the router RiDiscovery m2If the router fills the routing information before the marking domain passes, no operation is performed; discovery m2The marker domain does not contain any marker informationThen with probability p1To m2The labeling domain is labeled. Obviously, in the attack path, the farther away from the victim host, the router flag m2The greater the probability that will be. Thus:
Figure GDA0003272335250000091
Figure GDA0003272335250000092
Figure GDA0003272335250000093
Figure GDA0003272335250000094
the probability of marking the data packet by the previous router is recurred according to the rule, and the detailed description is omitted
Figure GDA0003272335250000095
And (4) calculating.
It can be deduced that:
Figure GDA0003272335250000096
Figure GDA0003272335250000097
Figure GDA0003272335250000098
thus, also after counting, counting and sorting, a path from the victim host to the aggressor host can be reconstructed and described more accurately for routers further away from the victim host. If a marker domain is adopted independently, the gradient at one end of the curve is small, the sequence of the routers in the attack path is difficult to determine, and a large error exists. Through the analysis of the double-domain packet marking as shown in fig. 3, the problem that the sequence is difficult to determine because the marking times of a single marking domain at the tail end are small is solved by setting two marking domains and adopting two opposite marking methods.
The two-way marking method is adopted to carry out two-way marking, the attacking host sends data packets to the victim host and the data packets are forwarded through 10 routers, and the experimental result is shown in figure 4. The invention adopts a double-domain marking method, and the accuracy rate of reconstructing the data packet forwarding path is greatly improved compared with the common packet marking algorithm. When the transmitted data packet reaches 300, the higher tracing accuracy rate can be approached; when the transmitted data packet reaches 500, the accurate source tracing can be basically achieved. Therefore, the requirement on the number of the data packets for accurate source tracing is low, after the attack is detected, the attack host sending the attack data packets can be traced more quickly, the attack data packets are reported to the high level, and countermeasures are taken to prevent the attack from causing further damage in time.
The above-mentioned embodiments are only preferred embodiments of the present invention, and are not intended to limit the technical solution of the present invention, and it should be understood by those skilled in the art that the technical solution can be modified and replaced by a plurality of simple modifications and replacements without departing from the spirit and principle of the present invention, and the modifications and replacements also fall into the protection scope covered by the claims.

Claims (6)

1. A tracing method of attack data packets based on dynamic probability double-domain packet marking is characterized by comprising the following steps:
setting a label space of the two-domain label domain;
marking the two marking domains by adopting opposite marking strategies;
in the marking process, the router selects the most appropriate marking probability according to different data packets, the hop count of the data packets forwarded by the router is judged according to the TTL field of the data packets, so that a marking probability correction coefficient is calculated, the marking probability is indirectly controlled through the probability correction coefficient, finally, the distribution function of the marking probability is close to linearization, and the tracing accuracy of the attack data packets is optimized; the modification of the marking probability is only related to the self attribute of the data packet, but not related to the router, and the marking probability is selected in a self-adaptive mode;
when a packet is forwarded by a router, the router forwards the packet with a probability p1Marking own routing information to m of data packet1In the mark field, with a probability p2Marking own routing information to m of data packet2In the mark field, m1The "overlay" criterion is enforced in the mark field, and m2The "back-off" criterion is enforced in the mark field: router preparation to m1When writing in the mark field, if m1The label domain has been labeled by other routers, which are still in probability p1At m1Writing mark information in the mark field for covering; and prepare to m2When writing in the mark field, if m2The mark domain is marked by other router, then the router does not continue to go to m2Writing in a mark field;
after the attack is detected, the victim host counts all attack data packets and reconstructs an attack path by two steps:
(1) all the occurring mark information in the mark domain is the router forming the attack path;
(2) counting the occurrence times of the marking information; m is1、m2Respectively representing two marker domains in the marker space; m is1The more frequently appearing routers are closer to the victim host, and the times are decreased progressively along the attack path to the attack host; m is2The router with the larger occurrence number is closer to the attacking host, and the number of times of the router with the larger occurrence number is decreased towards the victim host along the attacking path.
2. The attack data packet tracing method based on the dynamic probability double-domain packet marking according to claim 1, characterized in that: setting a mark space for 33 bit fields of IP data packets related to fragments, and setting 16 bits of the mark space as m1Flag field, another 16 bits set to m2The flag field further has 1 bit as a flag bit F indicating whether or not the adaptive flag probability is used, and if the F bit is 1, the flag bit indicates that the adaptive flag probability is used, and if the F bit is 0, the flag bit indicates that the adaptive flag probability is not used.
3. The attack data packet tracing method based on the dynamic probability double-domain packet marking according to claim 1, characterized in that: the specific initial value of the TTL field is determined by an operating system, the TTL values of different operating systems are different, and the marking probability correction coefficient is determined by subtracting the TTL values after the router forwards a plurality of hops from the initial TTL values of the operating systems.
4. The attack data packet tracing method based on the dynamic probability double-domain packet marking according to claim 1, characterized in that: if the data packet still does not reach the target host for more than 20 hops in the network transmission, the data packet is regarded as the target unreachable and is discarded.
5. An attack data packet tracing system based on dynamic probability double-domain packet marking is characterized by comprising:
the double-domain mark space setting module is used for setting a mark space by utilizing fields related to fragments in the IP data packet in the data packet, the mark space is divided into two mark domains, and the mark space in each mark domain is used for the router to write self information;
the marking module is used for executing a 'coverage' criterion on the first marking domain and executing a 'deferral' criterion on the second marking domain by setting a marking strategy, and the two marking domains are marked by adopting opposite marking strategies;
the data packet statistical analysis module is used for counting all attack data packets of the damaged host to reconstruct an attack path, and all the occurring marking information in the marking domain is the router forming the attack path; counting the occurrence times of the marking information; m is1The router with more occurrence times in the mark domain is closer to the victim host, and the times along the attack path to the attack host are decreased progressively; m is2The more frequently appearing routers in the marker domain are closer to the attacking host and along the attackThe number of times the path is directed to the victim host is decremented.
6. The attack data packet tracing system based on dynamic probability double-domain packet marking according to claim 5, characterized in that: the marking module realizes that the router selects the most appropriate marking probability according to different data packets, the hop count of the data packets forwarded by the router is judged according to the TTL field of the data packets, so that the marking probability correction coefficient is calculated, the marking probability is indirectly controlled through the probability correction coefficient, finally, the distribution function of the marking probability is close to linearization, and the tracing accuracy of the attack data packets is optimized.
CN202011148590.4A 2020-10-23 2020-10-23 Attack data packet tracing method and system based on dynamic probability double-domain packet marking Active CN112272178B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011148590.4A CN112272178B (en) 2020-10-23 2020-10-23 Attack data packet tracing method and system based on dynamic probability double-domain packet marking

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011148590.4A CN112272178B (en) 2020-10-23 2020-10-23 Attack data packet tracing method and system based on dynamic probability double-domain packet marking

Publications (2)

Publication Number Publication Date
CN112272178A CN112272178A (en) 2021-01-26
CN112272178B true CN112272178B (en) 2021-11-30

Family

ID=74341860

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011148590.4A Active CN112272178B (en) 2020-10-23 2020-10-23 Attack data packet tracing method and system based on dynamic probability double-domain packet marking

Country Status (1)

Country Link
CN (1) CN112272178B (en)

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1997023A (en) * 2006-12-19 2007-07-11 中国科学院研究生院 Internal edge sampling method and system for IP tracking
CN102801727A (en) * 2012-08-13 2012-11-28 常州大学 DDoS attacker tracing method based on autonomous system
CN105763449A (en) * 2016-03-23 2016-07-13 东北大学 Single packet source-tracing method based on storage resource adaptive adjustment
CN105791275A (en) * 2016-02-25 2016-07-20 上海交通大学 Modulo operation based denial of service attack trace back method
CN105812372A (en) * 2016-03-23 2016-07-27 东北大学 Single-packet tracing method based on label switching
CN107105471A (en) * 2017-05-23 2017-08-29 山东大学 WSN data transfer paths source tracing method and system based on orthogonal mark
CN107196939A (en) * 2017-05-22 2017-09-22 南京邮电大学 A kind of mixing packet making traceability system and method suitable for SDN
CN108881316A (en) * 2018-08-30 2018-11-23 中国人民解放军国防科技大学 Attack backtracking method under heaven and earth integrated information network
CN109120602A (en) * 2018-07-25 2019-01-01 中国人民公安大学 A kind of IPv6 attack source tracing method

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104038384A (en) * 2014-05-22 2014-09-10 中国电子科技集团公司第三十研究所 Tracking and tracing system based on GBF and working method thereof
SG10201912933VA (en) * 2016-03-23 2020-02-27 Agency Science Tech & Res Cloud-based forensic ip traceback
CN107026867A (en) * 2017-06-28 2017-08-08 西安电子科技大学 Method based on the controllable routing algorithm positioning DoS attack source of father node
CN111490975A (en) * 2020-03-23 2020-08-04 山东大学 Distributed denial of service DDoS attack tracing system and method based on software defined network

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1997023A (en) * 2006-12-19 2007-07-11 中国科学院研究生院 Internal edge sampling method and system for IP tracking
CN102801727A (en) * 2012-08-13 2012-11-28 常州大学 DDoS attacker tracing method based on autonomous system
CN105791275A (en) * 2016-02-25 2016-07-20 上海交通大学 Modulo operation based denial of service attack trace back method
CN105763449A (en) * 2016-03-23 2016-07-13 东北大学 Single packet source-tracing method based on storage resource adaptive adjustment
CN105812372A (en) * 2016-03-23 2016-07-27 东北大学 Single-packet tracing method based on label switching
CN107196939A (en) * 2017-05-22 2017-09-22 南京邮电大学 A kind of mixing packet making traceability system and method suitable for SDN
CN107105471A (en) * 2017-05-23 2017-08-29 山东大学 WSN data transfer paths source tracing method and system based on orthogonal mark
CN109120602A (en) * 2018-07-25 2019-01-01 中国人民公安大学 A kind of IPv6 attack source tracing method
CN108881316A (en) * 2018-08-30 2018-11-23 中国人民解放军国防科技大学 Attack backtracking method under heaven and earth integrated information network

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
Across-Domain Deterministic Packet Marking for IP Traceback;Guang Jin;《2007 Second International Conference on Communications and Networking》;20080307;第382-386页 *
DDoS攻击下的数据包标记优化方案的研究;靳娜;《中国优秀硕士学位论文全文数据库（电子期刊） 信息科技辑》;20140115;正文第3-4章 *
基于自适应包标记的IP源追踪方案;李刚等;《微计算机信息》;20101225(第36期);第3-5页 *

Also Published As

Publication number Publication date
CN112272178A (en) 2021-01-26

Similar Documents

Publication Publication Date Title
CN107147670B (en) APT (android Package) defense method based on game system
US20200358812A1 (en) Method for determining main chain of blockchain, device, and storage medium
US20090182867A1 (en) Method and apparatus for identifying a packet
CN110719275B (en) Method for detecting power terminal vulnerability attack based on message characteristics
CN108667853A (en) The detection method and device of malicious attack
US20030115485A1 (en) Hash-based systems and methods for detecting, preventing, and tracing network worms and viruses
CN108881250B (en) Power communication network security situation prediction method, device, equipment and storage medium
CN109120602B (en) IPv6 attack tracing method
CN101841533A (en) Method and device for detecting distributed denial-of-service attack
CN104022999A (en) Network data processing method and system based on protocol analysis
CN110225037A (en) A kind of ddos attack detection method and device
Yao et al. Detection and defense of cache pollution attacks using clustering in named data networks
CN112995238B (en) Method for reducing DDoS attack, programmable switch and SDN controller
CN103973801B (en) Wireless sensor network source tracing and tracking method
CN110768946A (en) Industrial control network intrusion detection system and method based on bloom filter
CN108833430B (en) Topology protection method of software defined network
DE112019002591T5 (en) FORWARDING ELEMENT DATA LEVEL WITH FLOW SIZE DETECTOR
CN112272178B (en) Attack data packet tracing method and system based on dynamic probability double-domain packet marking
CN112738107A (en) Network security evaluation method, device, equipment and storage medium
CN104883362A (en) Method and device for controlling abnormal access behaviors
Vincent et al. A survey of IP traceback mechanisms to overcome denial-of-service attacks
CN114172697B (en) Method for defending IP address spoofing DDoS attack in high-speed network
KR100432420B1 (en) Efficient attack detection method using log in Intrusion Detection System
CN105897739A (en) Data packet deep filtering method
CN113507476B (en) Defense method, system, equipment and storage medium for ARP spoofing attack

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant